DOP-C02 Security and Compliance Practice Question

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which AWS service can automatically manage the encryption keys with minimal configuration?

⚠ Common exam trap

Many candidates confuse SSE-S3 with SSE-KMS, assuming that any key management service (KMS) is required for automated encryption, but SSE-S3 provides fully automated key management with even less configuration than SSE-KMS.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SSE-S3

SSE-S3 (Server-Side Encryption with S3-Managed Keys) is the correct answer because it requires minimal configuration: you simply enable it on the bucket or object, and AWS fully manages the encryption keys, including rotation and protection, without any additional setup or key management overhead.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
SSE-C
Why it's wrong here
SSE-C is incorrect because it shifts encryption-key management to the customer. With SSE-C, you supply your own encryption key with every S3 request, and Amazon S3 performs AES-256 encryption using that key, but you remain responsible for securely storing, rotating, and protecting the key material. This contradicts the requirement for a fully managed, zero-configuration encryption solution, since SSE-C introduces significant operational overhead and key-management burden.
✗
SSE-KMS
Why it's wrong here
SSE-KMS is incorrect for this requirement because it requires creating and managing an AWS KMS customer master key (CMK) before S3 can encrypt objects. Although SSE-KMS provides envelope encryption, a separate CMK, IAM permissions, and optional key rotation, it adds administrative complexity and per-request API costs. If the company wants to encrypt S3 data at rest without additional key management or cost, SSE-KMS is more than what is needed, making SSE-S3 the appropriate choice.
✓
SSE-S3
Why this is correct
SSE-S3 is correct because it is Amazon S3's built-in server-side encryption that requires no additional configuration that the customer must perform. With SSE-S3, Amazon owns and manages the encryption keys on your behalf, using AES-256 with 256-bit keys, and applies encryption automatically to new objects written to S3. This provides a simple, fully managed, and effortless way to encrypt data at rest, aligning exactly with the stated requirement.
✗
Client-side encryption
Why it's wrong here
Client-side encryption is incorrect because the encryption occurs outside of Amazon S3, before the data is transmitted to AWS. In this approach, you encrypt the data on your own applications and then upload the ciphertext to S3, meaning S3 stores the already-encrypted objects but never performs encryption itself. Since the company explicitly wants to encrypt data at rest in Amazon S3 using an S3 feature, client-side encryption does not qualify as a server-side encryption option, and the key management burden remains on the customer.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DOP-C02 Security and Compliance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question